公开(公告)号：US11947687B2

公开(公告)日：2024-04-02

申请号：US17449036

申请日：2021-09-27

申请人： INTERNATIONAL BUSINESS MACHINES CORPORATION

发明人： Florian Fritz ,  Timo Kussmaul ,  Dennis Zeisberg ,  Angel Nunez Mencias ,  Dimitrij Pankratz ,  Stefan Liesche ,  Sebastian Hense

IPC分类号： G06F21/60 ,  G06F8/65 ,  G06F21/44 ,  H04L9/08

CPC分类号： G06F21/606 ,  G06F8/65 ,  G06F21/44 ,  H04L9/088

摘要： A computer-implemented method for securely transferring a secret from a source computing component to a target computing component, wherein the source computing component and the target computing component are part of a secure computing environment is disclosed. The method comprises upon the source computing component receiving from the target computing component a signed attestation document, verifying, by the source computing component, an authenticity and content of the attestation document, and upon a successful verification of the authenticity and the content, transferring, by the source computing component the secret to the target computing system. Thereby, the attestation document is attesting that the target computing component is compliant to an update governance rule.

公开(公告)号：US20230095755A1

公开(公告)日：2023-03-30

申请号：US17449036

申请日：2021-09-27

申请人： INTERNATIONAL BUSINESS MACHINES CORPORATION

发明人： Florian Fritz ,  Timo Kussmaul ,  Dennis Zeisberg ,  Angel Nunez Mencias ,  Dimitrij Pankratz ,  Stefan Liesche ,  Sebastian Hense

IPC分类号： G06F21/60 ,  G06F8/65 ,  G06F21/44 ,  H04L9/08

摘要： A computer-implemented method for securely transferring a secret from a source computing component to a target computing component, wherein the source computing component and the target computing component are part of a secure computing environment is disclosed. The method comprises upon the source computing component receiving from the target computing component a signed attestation document, verifying, by the source computing component, an authenticity and content of the attestation document, and upon a successful verification of the authenticity and the content, transferring, by the source computing component the secret to the target computing system. Thereby, the attestation document is attesting that the target computing component is compliant to an update governance rule.

公开(公告)号：US20230079773A1

公开(公告)日：2023-03-16

申请号：US17472972

申请日：2021-09-13

申请人： International Business Machines Corporation

发明人： Florian Fritz ,  Timo Kussmaul ,  Dennis Zeisberg ,  Angel Nunez Mencias ,  Dimitrij Pankratz ,  Stefan Liesche ,  Sebastian Hense

IPC分类号： G06F21/57 ,  G06F21/64

摘要： A computer-implemented method for building trusted executable software using trusted building units, wherein a path between the building units is untrusted, is disclosed. The method comprises generating, by each of the trusted building units, an identifier for identifying an output of the respective trusted building unit, wherein the respective trusted building unit also generates a signed confirmative certificate comprising the identifier. The method comprise as well utilizing, by each of the distributed trusted building units, output results of at least one of a predecessor build unit of the trusted building unit as input, validating that each of the signed confirmative certificates conforms to a predefined set of policy rules, and upon a failed validating of the signed confirmative certificate of one of the trusted building units, terminating the building of the trusted executable software.

公开(公告)号：US11809572B2

公开(公告)日：2023-11-07

申请号：US17472972

申请日：2021-09-13

申请人： International Business Machines Corporation

发明人： Florian Fritz ,  Timo Kussmaul ,  Dennis Zeisberg ,  Angel Nunez Mencias ,  Dimitrij Pankratz ,  Stefan Liesche ,  Sebastian Hense

IPC分类号： G06F21/00 ,  G06F21/57 ,  G06F21/64

CPC分类号： G06F21/577 ,  G06F21/64 ,  G06F2221/033

摘要： A computer-implemented method for building trusted executable software using trusted building units, wherein a path between the building units is untrusted, is disclosed. The method comprises generating, by each of the trusted building units, an identifier for identifying an output of the respective trusted building unit, wherein the respective trusted building unit also generates a signed confirmative certificate comprising the identifier. The method comprise as well utilizing, by each of the distributed trusted building units, output results of at least one of a predecessor build unit of the trusted building unit as input, validating that each of the signed confirmative certificates conforms to a predefined set of policy rules, and upon a failed validating of the signed confirmative certificate of one of the trusted building units, terminating the building of the trusted executable software.